Edit required_fields field for custom rules in UI and API

[nikitaindik]

Description

This documentation request is basically a clone of the "related_integrations" documentation request, but for "required_fields".

We are wrapping up the work on the PR that adds an ability to add and edit rule's required fields. "Required fields" is an optional field that shows the user which Elasticsearch fields are needed for the rule to run properly. Currently required fields are hardcoded in Elastic prebuilt rules. Once this PR is merged, users will be able to modify required fields for custom rules.

Background & resources

• PRs: [Security Solution] Allow users to edit required_fields field for custom rules kibana#180682
• Issues/metas: [Security Solution] Allow users to edit required_fields field for custom rules kibana#173594
• Point of contact: @nikitaindik
• Test environments: https://nikitaindik-pr-180682-editable-required-fields.kbndev.co/kbn (credentials: https://p.elstc.co/paste/U6uTAkz3#WW6hltDBqi++3e3Kzpi5bGiEHhKtAfKEnkRFsK6juZL)

Which documentation set does this change impact?

ESS and serverless

ESS release

8.15

Serverless release

Mon, May 20, 2024

Feature differences

The feature is identical in ESS and Serverless.

API docs impact

The feature touched existing rule management endpoints. All endpoints will accept required fields as well as return them. The followings APIs are affected

• Get rule GET /api/detection_engine/rules
• Create rule POST /api/detection_engine/rules
• Update rule PUT /api/detection_engine/rules
• Patch rule PATCH /api/detection_engine/rules
• Find rules GET /api/detection_engine/rules/_find
• Bulk create rules POST /api/detection_engine/rules/_bulk_create (endpoint is deprecated)
• Bulk update rules PUT /api/detection_engine/rules/_bulk_update (endpoint is deprecated)
• Bulk patch rules PATCH /api/detection_engine/rules/_bulk_update (endpoint is deprecated)
• Bulk actions POST /api/detection_engine/rules/_bulk_action
  • Edit rules
  • Export rules
  • Import rules
  • Rule response from bulk operations
• Import rules POST /api/detection_engine/rules/_import
• Export rules POST /api/detection_engine/rules/_export

Prerequisites, privileges, feature flags

No special requirements

---

Tasks

Beta Give feedback

1. Serverless docs — https://github.com/elastic/staging-serverless-security-docs/pull/357
2. Classic docs — Edit required_fields field for custom rules in UI [classic] #5287
3. API docs (classic) — Update API docs for required_fields #5190

[nikitaindik]

Hi @joepeeples! Just wanted to gently remind you about the classic docs PR we need for the v8.15 release :) Thanks!